An attacker sent a LastPass employee WhatsApp calls and a voicemail using an AI copy of the CEO's voice. The employee reported it. What gave it away.
Social Engineering Examples·6 sources
In April 2024 a LastPass employee got a string of WhatsApp messages from someone claiming to be the company's chief executive. Missed calls. Texts. A voicemail. The voicemail used AI-generated audio made to sound like the CEO, and the gist, as the CEO later recalled it, was "I need help urgently". The employee didn't reply. WhatsApp isn't a channel LastPass uses for business, the contact came outside working hours, and the whole thing had the pushy feel of a scam. So the employee ignored it and told the security team. LastPass said the attempt had no impact, then wrote it up on its own blog on 10 April 2024 as a warning to everyone else. Status: it failed, LastPass says nothing was affected, and nobody knows who was behind it.
| Step | What happened |
|---|---|
| Pick a face | The attacker chose LastPass's CEO to impersonate. Press reports say the voice clone was likely made from public recordings |
| Pick a channel | WhatsApp, with an account presenting as the CEO. Not a LastPass business channel |
| Pile on | Call after call, then texts, then a voicemail. The voicemail carried the fake voice and the urgent tone |
| The ask | Never reached. LastPass didn't describe a specific request, and none was acted on |
| The end | The employee disengaged and reported it. Security mitigated and shared the details with industry partners |
LastPass is a password manager owned by GoTo. The employee was described in press coverage as a sales executive. Neither the employee nor the attacker has been named.
Tip: a familiar voice is no longer proof of identity. If your "CEO" needs something urgently over a personal messaging app, that's the moment to call them back on a number you already have.
None of these tells is about the audio. The employee didn't need to detect a deepfake. The context gave it away.
Voice cloning used to be a headline tactic: the 2019 UK energy firm case, then the Arup video-call fraud a few months before this one. LastPass's point in publishing was different. The tools are now cheap enough that ordinary fraudsters use them for ordinary executive-impersonation attempts. This wasn't a nation state. It was a scam that happened to have a synthetic voice attached.
It's also a clean example of the attack dying at the human layer. Compare it with the WPP attempt the following month, which failed the same way: a person found the request odd and declined before any money was discussed.
See also voice cloning, deepfake examples and CEO fraud.
An April 2024 attempt to pressure a LastPass employee through WhatsApp, using calls, texts and a voicemail with an AI copy of the CEO's voice. The employee ignored it and reported it. Nothing was lost.
No. The company said the attempt had no impact and no request was acted on.
LastPass didn't say. Press reports noted it was likely generated from the CEO's publicly available podcast and video appearances.
To warn that deepfake voice tools are now cheap and common enough for everyday executive-impersonation fraud, not just sophisticated actors.
Social Engineering Examples. “LastPass employee ignores an AI clone of the CEO's voice on WhatsApp (2024)”. Accessed 3 November 2026. https://socialengineeringexamples.com/lastpass-deepfake-voice-ceo-2024
the attacker selected LastPass's CEO as the impersonation target and contacted a LastPass employee via WhatsApp.
employee-facing OSINT exposure (executive names, roles, public appearances) is very hard to eliminate at enterprise scale for anyone publicly identified as a company's CEO; the realistic control assumes attackers already have this and hardens the process it later gets used against, rather than trying to hide it.
the attacker used an audio deepfake to impersonate the CEO through WhatsApp.
an organization has little ability to stop a third party from creating deepfake audio or using an impersonating messaging account; the practical control is to treat a familiar-sounding voice as insufficient proof of identity on its own.
the attacker reached the employee through WhatsApp, a channel outside LastPass's sanctioned business communications, opening with a series of missed calls and text messages from the account posing as the CEO.
channel discipline. Requests arriving over personal messaging apps like WhatsApp rather than approved internal business channels should be treated as inherently suspect, regardless of who they claim to be from.
the attacker followed up with at least one voicemail carrying the AI-generated deepfake audio of the CEO's voice, applying forced urgency to push the employee toward an immediate, unverified response.
security awareness training that specifically covers AI voice cloning and classic social engineering hallmarks (forced urgency, off-hours contact, pressure to bypass normal process), paired with a no-blame reporting culture that makes it easy and expected for employees to escalate suspicious contacts rather than act on them.
the likely end goal was an executive-impersonation fraud outcome, such as a fraudulent transfer or a credential/access request, but LastPass's disclosure does not describe a specific ask ever being made or acted on. The employee recognized the unusual channel, off-hours timing, and urgency as social engineering hallmarks, disengaged without complying, and reported it to internal security, so the chain never reached completion.
mandatory out-of-band verification, contacting the purported executive or a known security channel through an already-established method, never the channel the request arrived on, before acting on any urgent or unusual request; executive-impersonation playbooks and pre-agreed verification protocols for high-stakes asks. This is the control that actually stopped the attempt: the employee's disengagement and report to internal security closed the chain before any payout could occur.
Browse by what this case has in common with others in the library.
Fraudsters faked WPP CEO Mark Read on WhatsApp and staged a Teams call with a cloned executive voice. The agency…
Texts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025.…
A compromised email sent a Wheeling, WV nonprofit a fake solar panel invoice. It paid $30,750 to an Oklahoma man's…
A Lapsus$ affiliate used a contractor's stolen Uber password, likely bought on the dark web, flooded them with MFA push…
In 2015, fake emails from Ubiquiti's CEO and a real London lawyer got its finance chief to wire $46.7M. How…
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
The HP spying scandal began with a hunt for a boardroom leaker. Hewlett-Packard's investigators hired contractors who posed as directors…
North Korea-linked hackers ran fake job interviews for crypto firms, then told applicants to paste a 'camera fix' that installed…
A job candidate at Vidoc Security Lab hid behind a real-time face filter and refused to cover his face. What…
The EA data breach began in June 2021, when hackers used a Slack session cookie they said cost $10 to…
Noma Security hid a prompt injection in a Salesforce web form and made Agentforce leak CRM data to a $5…
In August 2023, Clorox says, someone phoned its outsourced Cognizant help desk pretending to be two different employees. Agents reset…
A caller posing as Carnival's IT security team got an employee's login in April 2026. The attacker copied data on…
A Houston- and California-based ring spoofed or compromised business emails to trick four companies and one New Jersey township into…
A forged "change your remittance bank account" email tricked a Puerto Rico government corporation into wiring $2.6M to a fraudster-controlled…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
A fraudster posing as AFGlobal's CEO, backed by a fake KPMG "attorney," pressured the accounting director into wiring $480,000 to…
The SEC's 2018 Section 21(a) report detailed how fake-executive and fake-vendor BEC emails caused nearly $100 million in combined losses…
A caller posing as Standard Bank got an 18-year-old to move her R438,900 education fund to a 'safe' account in…
A scammer spoofed a New Zealand bank's number and obtained authentication codes by claiming they would suspend banking and cancel…
A small Columbus, Ohio public materials manufacturer disclosed in a February 2026 SEC 8-K that it lost $898,325 to an…
A fraudster impersonating the company's chief executive tricked a Pivotal employee into emailing back affected employees' W-2 tax data.
The FBI's December 2024 warning on AI-enabled fraud: AI text, fake IDs, cloned voices and deepfake video, and what the…
Social Engineering Examples